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In a simultaneous paired approach to closely-spaced parallel runways, a pair of 
aircraft flies in close proximity on parallel approach paths. The aircraft pair must 
maintain a longitudinal separation within a range that avoids wake encounters and, 
if one of the aircraft blunders, avoids collision. Wake avoidance defines the rear 
gate of the longitudinal separation. The lead aircraft generates a wake vortex that, 
with the aid of crosswinds, can travel laterally onto the path of the trail aircraft. As 
runway separation decreases, the wake has less distance to traverse to reach the 
path of the trail aircraft. The total system error of each aircraft further reduces this 
distance. The total system error is often modeled as a probability distribution 
function. Therefore, Monte-Carlo simulations are a favored tool for assessing a 
"safe" rear-gate. However, safety for paired approaches typically requires that a 
catastrophic wake encounter be a rare one-in-a-billion event during normal 
operation. Using a Monte-Carlo simulation to assert this event rarity with 
confidence requires a massive number of runs. Such large runs do not lend 
themselves to rapid turn-around during the early stages of investigation when the 
goal is to eliminate the infeasible regions of the solution space and to perform trades 
among the independent variables in the operational concept. One can employ 
statistical analysis using simplified models more efficiently to narrow the solution 
space and identify promising trades for more in-depth investigation using Monte- 
Carlo simulations. These simple, analytical models not only have to address the 
uncertainty of the total system error but also the uncertainty in navigation sources 
used to alert an abort of the procedure. This paper presents a method for 
integrating total system error, procedure abort rates, avionics failures, and 
surveillance errors into a statistical analysis that identifies the likely feasible runway 
separations for simultaneous paired approaches. 
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Nomenclature 

standard deviation 

standard deviation of the airspeed difference between paired aircraft 

standard deviation of the longitudinal separation due to deviation in airspeed difference 

standard deviation in ADS-B position uncertainty due to latency 

standard deviation of the estimated position uncertainty for ADS-B 

standard deviation of the flight technical error along an axis (lateral or longitudinal) 

standard deviation of the navigation error along an axis (lateral or longitudinal) 

standard deviation in the observed longitudinal separation 

total standard deviation in longitudinal separation performance 

the true lateral distance between aircraft 

minimum feasible runway separation 
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target limit of total alert rate (lateral or longitudinal), per aircraft, per procedure 

target limit of alert rate due to hardware failure, per aircraft, per procedure 

target limit of alert rate due to the observed drift of the aircraft exceeding the alerting bound 

target limit of alert rate for longitudinal drift, per procedure 

lateral distance the wake vortex must travel to encounter the trail aircraft 

lateral location from the lead aircraft centerline to the generation point for the wake vortex 

estimated position uncertainty 

error function 

inverse error function 

final approach fix 

flight technical error 

global positioning system 

instrument landing system 

knots (nautical mile per hour) 

rear gate of the longitudinal separation within which no wake encounter will occur 
navigation error 

number of independent FTE samples per procedure 
nautical mile 

probability density function 
area navigation 

required navigation performance 
radius of the wake vortex 

delay in trail aircraft response during dependent operation 

time it takes the wake vortex to laterally travel the D enC ounter distance 

total system error 

probability that actual position is within the integrity bound, per aircraft per procedure 

probability of containment loss due to unalerted avionics failure 

probability of containment loss due to position uncertainty 

maximum allowable crosswind 

true ground speed of the trail aircraft 

self-transport velocity of the wake vortex 

longitudinal bound for issuing an alert 

front gate location of the separation window, relative to the lead aircraft 

longitudinal integrity bound 

length of the longitudinal separation window 

lateral bound for issuing an alert 

observed lateral deviation of aircraft from path 

lateral bound for position integrity 

difference between observed and actual lateral deviation of the aircraft from path 


I. Introduction 

T HE Closely Spaced Parallel Operations (CSPO) Working Group of the Federal Aviation 
Administration is investigating operational concepts to allow simultaneous paired approaches at 
runways separated by as little as 700 ft. 1,2 In a simultaneous paired approach, a pair of aircraft flies in close 
proximity to each other as they approach parallel runways. The aircraft pair must maintain longitudinal 
separation within a range that avoids wake encounters and, if one of the aircraft blunders, also avoids 
collision. Wake avoidance defines the rear gate of the longitudinal separation. The lead aircraft generates 
a wake vortex that can, with the aid of crosswinds, travel laterally onto the path of the trail aircraft. As 
runway separation decreases (and, therefore, the lateral separation of the parallel approach paths decreases), 
the wake has less distance to travel to cross the path of the trail vehicle. The lateral total system error 
(TSE) of each aircraft further shortens this distance. TSE characterizes how far from its intended path each 
aircraft may deviate. TSE is often modeled as statistical variation and typically is defined using a 
probability density function (PDF). 1,6 Therefore, Monte-Carlo simulations are a favored tool for assessing 
the wake- safe gate. However, definitions of safety used for such operations often require that a wake 
encounter be a very rare event during normal operation; one catastrophic wake encounter per billion flights 
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Figure 1: Paired Approach Separation Distances 

is typical. 6 Using a Monte-Carlo simulation to assert the required rarity of a wake encounter with 
confidence, therefore, requires a massive number of runs. Even for low-fidelity, fast-time simulations on 
modern computers, such runs do not lend themselves to rapid turn-around during the early stages of 
investigation when the goal is to eliminate the infeasible regions of the solution space and to perform trades 
among the independent variables in the operational concept. Statistical analysis using simplified models 
can be employed more efficiently to narrow the solution space and identify promising trades for more in- 
depth investigation using Monte-Carlo simulations. 

Total system error is not the only variation at play in paired approaches. For closely spaced parallel 
approaches, passive safety is not possible. The operational concepts must rely on active monitoring to 
ensure conformance with the procedure. For many paired approach concepts, active monitoring relies on 
ADS-B broadcasts and on-board navigation solutions. Both exhibit uncertainty, which can be statistically 
modeled. Due to this uncertainty, the alerting threshold is not a hard limit to path deviation. Therefore, the 
statistical analysis must account for un-alerted deviations beyond the threshold when determining the 
probability of a wake encounter. This paper presents a method for integrating total system error, 
surveillance errors^, limits on alert rates, and avionics failures into a statistical analysis that identifies the 
likely feasible runway separations for simultaneous paired approaches. 


II. Approach Geometry 

Candidate geometries for closely spaced parallel approaches are detailed in references 1 through 6. 
This paper presents a model to investigate parallel approaches by the aircraft pair. Prior to the start of the 
procedure, air traffic control vectors a pair of aircraft onto parallel approach paths at a point between the 
initial approach fix (IAF) and the final approach fix (FAF). The aircraft with the faster final approach 
speed is placed behind the aircraft with the slower final approach speed. The aircraft also begin with a 
vertical separation of 1000 ft to allow each aircraft to safely establish their approach path and to allow the 
fast aircraft to establish longitudinal separation from the slow aircraft. The fast aircraft can start at either 
the higher altitude or the lower altitude. As the procedure starts, each aircraft flies at a constant altitude 


^ This is the error between the actual relative position of the paired aircraft, and the relative position 
observed by the trail aircraft. 
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Figure 2. Separation Window at FAF 

until encountering the glidepath and then descends along the glidepath. From the start of the procedure to 
the FAF, the slow aircraft flies an assigned constant speed (nominally 180 KT) and the fast aircraft 
maintains speed and position against the slow aircraft. The fast aircraft executes this dependent operation 
until it reaches its final approach speed (matching speed of the slow aircraft as the slow aircraft decelerates 
upon reaching the FAF) or, if the fast aircraft reaches the FAF before detecting deceleration of the slow 
aircraft, the fast aircraft switches to independent operation at the FAF. 

Figure 1 depicts the longitudinal geometry of the paired-approach procedure, either with the option of 
passing 1 or without the option of passing 6 . The fast aircraft must maintain a longitudinal distance from the 
slow aircraft in a range defined to avoid two hazards. In the case where passing is not allowed, those 
hazards are collision and wake. To avoid collision, the fast aircraft must maintain a sufficient distance 
behind the slow aircraft such that the slow aircraft will not collide with the fast aircraft if the slow aircraft 
blunders across the fast aircraft's path. The collision-safe gate is defined to be passively safe, i.e. the trail 
aircraft does not monitor the lateral separation between aircraft. To avoid the wake hazard, the fast aircraft 
must be close enough to the slow aircraft that the wake of the slow aircraft passes behind the fast aircraft in 
the presence of adverse crosswind. For the procedure option that allows passing, the two hazards are both 
wake encounters. The fast aircraft must remain forward of a rear wake-safe gate to avoid encountering the 
wake of the slow aircraft. The fast aircraft must also remain behind a forward wake-safe gate so that the 
slow aircraft does not encounter the wake of the fast aircraft. The paired approach with passing relies on 
collision alerting rather than longitudinal separation to prevent collisions when one or both aircraft blunder. 
With or without passing, the fast aircraft must maintain its separation between the forward and rear gates 
from the loss of altitude separation until the slow aircraft crosses the threshold."^ 

The hazard-defined gates define separation windows of considerable length. However, the usable 
separation window at any given distance along the procedure is often smaller. 3, 4 The cause is a decrease in 
longitudinal separation that occurs on final approach, after the fast aircraft switches to independent 
operation. This decrease in separation is a function both of the difference in approach speeds and of the 
separation limits that must remain at the runway threshold. This decrease in separation forces the front gate 
of the separation window to retreat further back relative to the slow aircraft as one retraces the fast 
aircraft’s path away from the threshold. Even in the paired approach with passing, this retreat often 
constrains the fast aircraft to remain in a trail position until late in the approach. Thus, for much of the 
approach, the paired approach with or without passing has similar geometry that differs only in the location 
of the front gate of the separation window. For paired approaches with passing, the front gate is simply the 
distance that prevents the fast aircraft from driving its wake into the trail aircraft before the trail aircraft 
lands (i.e. it prevents the fast aircraft from flying too far ahead of the slow aircraft before the procedure 


* Both collision and wake risks are assumed to be negligible after the lead aircraft crosses the threshold. 
The assumption on collision risk is reasonable given that ground hazards restrict banking by the lead 
aircraft and the go-around procedure can be designed to increase lateral separation. However, further wake 
studies on landing and go around scenarios are needed to validate the assumption of negligible wake risk. 
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ends). For the paired approach without passing, the front gate is the distance that prevents the trail aircraft 
from losing passive safety against collision before the procedure ends. Thus, for both variations of paired 
approach, the separation window at the final approach fix (FAF) can be defined as show in Fig. 2. 

Once the front and rear gate have been estimated, the question remains whether the resulting separation 
window is long enough to accommodate the deviation in longitudinal separation that can occur under 
normal operation. Otherwise, the procedure may suffer an ineffectual rate of aborts. 

III. Modeling the Paired Approach with Errors and Uncertainties 

The analytical model presented here uses a target limit on nuisance aborts to define the normal 
allowable deviation in longitudinal separation. The longitudinal length of the separation window also 
depends on other variables subject to deviation or uncertainty. These variables include the total system 
error (TSE) of each aircraft (including its components of flight technical error [FTE] and navigation error 
[NE]), the error in the ADS-B reported position of the slow aircraft, and the deviation in the actual 
airspeeds of each aircraft. Therefore, given a probability distribution function (PDF) for these variables, 
one can statistically analyze the length of the separation window given a target probability of successful 
completion. The feasibility for a given pair of runways becomes a matter of comparing this computed 
window length against the length remaining from front gate and rear gate estimates. However, the front 
gate, rear gate, and window length computations are not independent. All three depend to some degree on 
the TSE of each aircraft. 1,4,6 Because a statistical model of the wake-safe distance (i.e. the rear gate) can be 
developed in common for both variations of paired approach, that model is presented here to show how it 
interacts with the window length. Computation of the front gate is detailed in Ref. 4 and will be presented 
here as an input parameter. 

The examples in this paper present estimates of the front gate, rear gate, and separation window at the 
final approach fix (FAF), before dependent operation ends and the flexibility of the trail aircraft to adjust its 
longitudinal separation diminishes. The examples present a paired approach to runways 28L and 28R at 
San Francisco (KSFO). 

A. The Front Gate 

The estimation of the front gate is divided into two lengths as shown in Fig. 2, the estimate of 
longitudinal separation compression on the final approach and the estimate of the separation limits at the 
threshold. The model of separation compression is common between the two procedure options, and is 
detailed in a companion paper 7 and in Ref. 4. However, the model of the separation limit is unique to each 
procedure option and is detailed in Ref. 4 and Ref. 6. Both references rely on a Monte-Carlo simulation to 
estimate the separation limit at the threshold. For paired approaches with passing, Johnson et al. estimate a 
separation limit of -1000 ft at the threshold for runway separations of 750 feet such as at KSFO, 4 i.e. the 
fast aircraft can be ahead of the slow aircraft by 1000 ft at the threshold. For paired approaches without 
passing, Eftekari et al. estimate that the trail aircraft must maintain a collision-safe separation of at least 
+1500 ft prior to the FAF and at least +750 ft on final approach for runways separated by 750 ft. 6 

The separation compression is primarily a function of the slow aircraft final approach speed and the 
final approach speed difference between aircraft. Additionally, Torres-Pomales et al. apply a worst-case 
bias between actual difference in approach speed and planned difference in approach speed. 4 The front 
gate can be tailored to each aircraft pair in real-time or generalized using the worst case aircraft pairing that 
will be supported by the procedure. Stassen et al. suggests a minimum approach speed of 120 KT with a 
maximum difference in approach speeds of 20 KT. 8 For the paired approach with passing, the worst-case 
front gate is -3500 ft (-0.58 NM) if the aircraft pair can limit bias in the actual speed difference (i.e. 
relative speed) to within + 4 KT of planned. For the paired approach without passing, the worst-case front 
gate is -5300 ft (-0.87 NM) using the same limits on speed deviation. The worst-case front gate decreases 
to -4400 ft (-0.72 NM) for a maximum approach speed difference of 15 KT and to -3500 ft (-0.58 NM) 
for a maximum approach speed difference of 10 KT. 3 The examples in this paper will use the worst-case 
3500 ft front gate at the FAF for the paired approach with passing. 

B. The Wake-Safe Distance 

7. Modeling Wake Vortex Transport 

This study uses the wake vortex transport model described by Stassen et al. 7 The model performs a 
constant velocity transport of the wake vortex from its generation point to the wake vortex encounter zone 
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Figure 3. Wake Transport Model 

of the trail aircraft. The transport velocity is the sum of the crosswind velocity and, when below 400 ft 
AGL, a self-transport velocity of 2 to 3 knots due to ground effects. Fig. 3 depicts the geometry of the 
lateral distance that the wake vortex can travel before encountering the trailing vehicle. § The wake 
encounter zone is a lateral distance from the centerline of the trail aircraft that is the sum of a safe 
encounter distance of 100 feet and the radius of the wake vortex. The distance for the wake to travel is the 
lateral distance between its generation point and the wake encounter zone. 

The following equation expresses the distance to a wake encounter: 

^encounter ~ ^safe - ^vortex - ^vortex (1) 


where, 

AY is the true lateral distance between aircraft, in feet. 

D safe is the safe encounter distance from the trail aircraft’s centerline, 100 ft. 

Rvortex is the radius of the vortex which equals Vi D vortex . 

Dvortex is the generation location of the vortex from the lead aircraft’s centerline. It is equal to (71 

Dwingspan/8) where D wingspan is the wingspan of the lead aircraft. 

The examples will assume the largest lead aircraft is a Boeing 747-400. The Boeing 747-400 has a 
wingspan of 21 1 ft 5 in. The distance equation, therefore, reduces to: 

D encounter = AY - 224.5 ft (2) 

The next part of the problem is determining the worst-case (i.e. minimum) AY for the paired approach. The 
worst case AY depends on the lateral TSE of each aircraft and is derived in the next section. 


§ Fig. 3 shows the geometry using the instantaneous true location of each aircraft. Applying a probability 
density function for the total system error of each aircraft is discussed later. 

The safe encounter distance is not necessarily the distance that avoids the wake but the distance where a 
wake encounter does not endanger the aircraft. For a more conservative analysis, one can instead use the 
half- wingspan of the largest aircraft eligible for the paired approach. 
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encounter is then converted to a time-to-encounter (T encounter ) by dividing D encounter by the wake transport 
velocity (V transport ). V transport is the sum of the maximum allowable cross wind (V C rosswind) and, if under 400 ft 
AGL, the self-transport velocity (V se if-transport)- 

y — V -I- (^self-transport ifh< 400ftAGL 

Vtransport " V crosswind + | Q . fh > 400 ft AGL W 

The examples will assume the maximum allowable Vcrosswind for the paired approach procedure is 10 knots. 

Lastly, the longitudinal wake-free gate is the product of the time-to-encounter (T encounter ) and the trail 
aircraft’s true ground speed (V trai i). 

P trail 

^wake-free ~ T encounter * V trail ~ D encounter * 77 (4) 

v transport 

Equation 4, therefore, models the wake-safe distance as a function of the trail aircraft speed and the 
TSE of the aircraft (as an input variable to D encounter ). The next section details how TSE is applied to 
determine D encounter under a definition of normal operation. Speed is applied using the speed schedule 
depicted in Fig. 4. The speed schedule 
consists of three segments: a constant 
speed segment, a deceleration segment, 
and a final approach segment. In the 
constant speed segment, both aircraft fly 
the same constant speed assigned by air 
traffic control. Once the lead aircraft 
reaches the FAF, both aircraft will 
decelerate to their final approach speed 
(deceleration segment). Then each aircraft 
flies their planned final approach speed to 
the runways threshold (final approach 
segment). The speed of the trail aircraft is 
constant in both the constant speed and 
final approach segments. Therefore, if 
other model inputs were constant, the 
wake-safe gate would also be constant in 
these segments. To limit lateral TSE, the 
procedure may require a GPS or RNP 
RNAV leg for this segment because these 
legs exhibit standard deviation of TSE that is independent of distance from threshold. Using an ILS 
navigation mode may be less desirable as the TSE for ILS navigation exhibits a linear increase with 
distance from the transmitter. 8,9 However, once past the FAF, the aircraft pair will require a navigation 
mode that decreases TSE to less than 8 m (95% confidence) at the runway threshold, if the paired approach 
is designed to operate under CAT III conditions. 11 As TSE decreases, worst-case AY increases, which may 
reduce or reverse the decrease in wake safe distance due to the lower speed in the deceleration and final 
approach segments. Thus, once the aircraft stabilizes on its final approach speed, the wake- safe distance 
may remain constant or grow (if TSE is decreasing) until 400 ft AGL when ground effects increase the 
wake transport speed. Because the constant segment speed is expected to be the same for all aircraft pairs, 
the wake-safe distance is also the same. Afterwards, the wake safe distance can be customized in real-time 
to the speed of the trail aircraft, or the wake-safe distance can be generalized by deriving the worst-case 
from the slowest supported final approach speed. The examples in this paper take place in the constant 
speed segment as the slow aircraft reaches the FAF. 

2. Closest Lateral Separation under Normal Operations 

Once the speed schedule is established, the closest allowable lateral separation under normal operations 
(AY) determines the design-to, wake-free gate for the procedure. The lateral separation between aircraft 
during the procedure is determined by the actual path each aircraft flies. The total system error (TSE) 
characterizes the deviation of the actual path from the desired path. TSE is made of three error 
components: path definition error (PDE), navigation error (NE), and flight technical error (FTE). PDE is 
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Figure 4 Speed Schedule for Paired Approach 
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the difference between the path defined by the on-board avionics and the desired path; it is normally 
negligible and will be ignored. NE is the error between the aircraft position estimated by the on-board 
navigation system and the actual position. FTE is the error in the autopilot or crew's ability to fly the path. 
NE and FTE will both be modeled as a normal distribution for simplicity. The normal distribution is often 
a good approximation for navigation errors. 11 ' 13 However, Levy et al. assert that PDFs capable of fatter 
tails like Johnson curves are a better fit for FTE. 14 Nevertheless, the data presented by Levy and FTE data 
for Quantas flights performing RNP approaches presented by Passerini 15 show that the normal distribution 
remains a reasonably accurate approximation of FTE and that the normal distribution appears to 
underestimate actual FTE distributions largely within the range of +3 a. The analytical model in this paper 
will assess deviation bounds in ranges beyond +4 g and, therefore, may overestimate deviation bounds. 
Since NE and FTE are both modeled as normal distributions, the resulting TSE model will also be a normal 
distribution. The TSE, NE, and FTE values presented here are 95% confidence bounds (1.96a). 

To date, comprehensive studies of FTE for aircraft on approach have examined a mixture of hand-flown 
and autopilot approaches using the Instrument Landing System (ILS) as the primary navigation aid. 
Thomas and Timoteo 16 and Thomas, Timoteo, and Huang 17 showed that the lateral FTE of ILS approaches 
increases with distance from threshold. Lateral FTE exceeded 200 ft at distances greater than 8 to 10 NM 
from the threshold and, on final approach, lateral FTE was less than 40 ft/NM from threshold. Eckstein 
also depicted the localizer deviation of ILS approaches starting at 7 NM from threshold and computed the 
lateral FTE at a point 3 NM from the threshold. 18 Unlike previous work, Eckstein divided the data between 
hand-flown and autopilot approaches. The lateral FTE of the autopilot approaches was less than 10 feet 
and an order of magnitude lower than the hand-flown approaches. Eckstein's study keeps open the 
possibility that it may be possible for the paired approach procedure to be performed from start to finish 
using an ILS navigation mode. However, in the absence of a comprehensive analysis of ILS approaches 
under autopilot and autothrottle alone, this study will proceed under the assumption that the aircraft pair 
performs an RNP or GPS RNAV approach to the FAF (though each aircraft may transition to an ILS 
navaid afterwards). Published data on TSE for RNAV approaches is equally scarce. Murphy presents data 
from Air France showing that the lateral TSE of aircraft on RNP approach was 59 m (194 ft) at the time 
they disengaged the autopilot prior to landing. 19 Passerini provides data on the Quantas fleet of Boeing 
737-800s that quantified the lateral FTE at 0.02 NM (37 m or 122 ft) for RNP approaches. 15 Aircraft 
performing paired approaches will likely require similar or better performance to that demonstrated by the 
Quants fleet. Therefore, the examples here use 37 m as the lateral FTE of both aircraft. 

This paper will assume that aircraft rely on GPS or an equivalent navigation system to estimate the 
position of the aircraft. GPS may either be autonomous or receive corrections from ground or satellite 
based sources. RTCA DO-242A characterizes the lateral NE of autonomous GPS as 12.5 m. 13 However, 
in an unpublished work, Eftekari identifies the lateral NE of autonomous GPS as 8 m (26 ft) based on 
observations from ADS-B flight tests at the FAA Technical Center in July 2007. 20 RTCA DO-242A also 
characterizes Wide-Area Augmentation System GPS with a lateral NE of 3.5 m (12 ft). 13 The examples 
here use 3.5 m as the NE for both aircraft. The resulting TSE for the examples is 37.2 m. 


Table 1: Total System Error of Example Aircraft Fleet 


TSE 

FTE 

NE 

Event Duration 

Events/Procedure 

37.2 m 

37.0 m 

3.5 m 

60s 

6 


Table 1 summarizes the final TSE, FTE, and NE values. Recognize that these errors are defined for a 
sample. To ascertain their effect on the maximum deviation over the entire approach path during normal 
operations, it is necessary to determine how many samples will occur during the course of the procedure. 
Aircraft do not suddenly jump from one error to the next, the error occurs as a random walk with a period 
in distance or time. The period of 60 seconds used in the example is in the neighborhood of the period 
reported by Boeing for its RNP-capable B737-NG aircraft 12 and the period exhibited in an unpublished 
model of TSE from Boeing. 21 For GPS receivers, the period between independent navigation error events 
is four to eight minutes. 22 However, because NE is much smaller than FTE, the period of NE events is 
made equal to FTE events for simplicity. Thus, the period of independent events for TSE, FTE, and NE are 
each set at 60 seconds. For the example paired approach to San Francisco runways 28L and 28R, the 
procedure duration is as long as six minutes, dependent on the speed schedule. Therefore, six independent 
events can occur during the course of the procedure. 
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Having established the lateral error characteristics of the aircraft, these characteristics are applied to a 
definition of normal operation in order to determine the allowable bounds on lateral deviation. Normal 
operation is defined by an alert rate and alert integrity for each aircraft. Independent monitoring of the lead 
aircraft by the trail is not practical because ADS-B uncertainties are large relative to the lateral path 
separation (see section C). Therefore, each aircraft is responsible for monitoring its own lateral deviation. 
The alert rate is assumed to be 10' 4 alerts per aircraft per procedure without a blunder. Aircraft are capable 
of monitoring their lateral FTE directly but lateral NE is unknown. Therefore, the actual position of the 
aircraft can exceed its alerting bounds without an alert. To maintain safety, a containment bound for 
normal operation is also defined using an alert integrity criterion equivalent to RNP integrity requirements 
of 99.999% containment per hour. 23 

First, the alerting bounds are computed. The per-aircraft, per-procedure alert rate (ar aircraft ) is divided 
between alerted hardware failure (ar avionics ) and lateral path drift (ar FTE ). It is assumed that the hardware will 
have an alerted failure at a rate of 5 x 10' 5 /hr. This alerted failure rate is taken from the continuity 
requirement for RNP of 99.99% per hour and assumes that half the probability of continuity failure is due 
to alerted hardware failure. It is also assumed that the hardware alert rate is linear with time and reduces to 
ar a vionics = 5 x 10‘ 6 /procedure. The remaining alert rate due to lateral FTE is 9.5 x 10‘ 5 per procedure. The 
equivalent alert rate per FTE sample (ar FTE ) is given by Eq. (6) where n ETE is the number of FTE samples 
per procedure. This equation is derived from the probability of no alert (1 - ar aircraft ) being equal to the 
combined probability of no hardware failure (1 - ar avionics ) and the probability that the aircraft will not 
exceed the alerting bound (1 - ar ETE ) for each of the six FTE samples (Eq. 5). The resulting per FTE sample 
alert rate is 1.6 x 10" 5 . 


(l WT aircraft ) — (1 ^avionics) (1 ®^FTE ) FTE 


( 5 ) 


CLV F te 


= 1 - 



Q^air craft 
avionics 


1/npTE 


( 6 ) 


Using ar ETE , the FTE bound that triggers an alert is determined from the normal distribution. Though 
deviations to only one side of the aircraft adversely affect the lateral separation between aircraft, the FTE 
bound will be computed for alerting on either side of the aircraft path. This is simpler from a procedural 
perspective. There is no need to identify the aircraft as being on the left or right runway and the alerting 
remains similar to loss of containment alerts for RNP. The following equation computes the alerting bound 
(y alert) where erf 1 is the inverse error function: 

FTE 

y alert = ^2 er/ _1 (l - 2 ar FTE ) (7) 


The resulting y alert is 4.16 g ete , beyond the 3 a range where a normal distribution exhibits the largest 
underestimation of the actual FTE distribution. 

Next, the alert integrity bound is computed from a target containment probability. The containment 
probability relates to the safety goal for the procedure. This example uses a containment bound equivalent 
to the RNP requirement of 99.999% containment per hour per aircraft, i.e. up aircraft = 10" 5 / hr. The study 
assumes that integrity loss is divided equally between un-alerted hardware failure (up avionics ) and position 
uncertainty (up TSE ). Therefore, both contributions have a probability of 5 x 10' 6 / hr. This probability is 
further divided into a probability of up avionics = up TSE = 8.3 x 10‘ 8 per FTE sample. The resulting probability 
of un-alerted containment loss per procedure (inclusive of both aircraft) is 2 x 10‘ 6 . 

The quantity up TSE represents the probability that a) the true position of aircraft (y tru e) is beyond the 
integrity bound (yintegrity) and b) the aircraft does not generate an alert. This occurs when the navigation 
error is of a sufficient adverse value to place the estimated position of the aircraft (y E TE) below the alerting 
bound y a i ert . Because of the symmetry in the normal distribution of lateral deviation, up TSE can be 
formulated as twice the probability, on one side of the path, that y true will be outside yintegrity when ly ETE l < 
y a i ert . Thus, one constructs the combined probability that the navigation error (yNE) is greater than yintegrity - 
y ETE for ah y ETE in the range [-y a i ert , Yaiert]- This is represented by the dual integral below: 
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where g fte and g ne are the standard deviation of the FTE and NE errors, respectively. Recognizing that 
the inner integral is equivalent to an integral with the range [-oo, y FTE - y integrity ], this integral reduces to: 
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where erfi) is the error function. This outer integral cannot be further reduced and must be resolved 
numerically. Therefore, the yintegrity value that corresponds with a up TS E value is solved iteratively using 
root-finding methods. 

The design-to lateral separation bounds for each aircraft are the larger of y a i ert and yintegrity- Table 2 
summarizes the probabilities used to define normal operation in this section. Table 3 shows the values of 
g F te? g"ne? y alert? Yintegrity? and the required path separation (AY), each rounded up to the nearest foot. The 
required path separation is computed from Eq. (2) where AY = 2 x max(y alert , yintegrity)? i.e. the worst case is 
when both aircraft deviate toward each other by the design-to separation bounds. The path separation 
shown here merely depicts the spacing at which the wake vortex does not need to move to encounter the 
trail aircraft if both aircraft are positioned at their integrity bounds. A feasible runway spacing must be 
much greater than the value shown. These results show that regardless of front gate constraints, paired 
approaches for the example aircraft fleet are infeasible for runways separated by less than 7 67 ft unless the 
lateral performance of the aircraft fleet improves. The next question is how much longitudinal spacing is 
needed to enable the procedure, and how much does that longitudinal spacing further expand the feasible 
runway spacing. To answer this question it is necessary to determine the minimum length of the separation 
window based on expected longitudinal deviation during normal operation. 


Table 2: Summary of Probabilities Defining Normal Lateral Deviation 


Total Alert Rate (ar aircraft ) 

10' 4 / aircraft / procedure 

Hardware Alert Rate (ar avionics ) 

5 x 10' 6 / procedure 

Position Alert Rate (ar F xE) 

9.5 x 1 O' 5 / procedure 

1.583 x 10 s /FTE sample 

Total Un-alerted Lateral Containment Loss (up proce dure) 

2.3 x 1 O' 6 / procedure 

Loss due to un-alerted hardware failure (up avionics ) 

5.0 x 1 O' 7 / procedure 

8.3 x 1 O' 8 / LTE sample 

Un-alerted loss due to position uncertainty (up TS E) 

5.0 x 1 O' 7 / procedure 

8.3 x 1 O' 8 / LTE sample 

Number of LTE samples per procedure (n FTF ) 

6 

Duration of LTE sample 

60 seconds 


Table 3: Example Lateral Deviation Parameters under Normal Operation 


Gfte 

62 ft 

^ne 

5.9 ft 

Yaiert 

258 ft 

Yintegrity 

271 ft 

path separation 

» 767 ft 
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C. Minimum Longitudinal Window under Normal Operations 

The minimum longitudinal window during normal operations is defined similarly to the expected lateral 
deviation during normal operations in the previous section. Normal operation is defined by a desired alert 
rate and an alert integrity criterion similar to lateral operation. Here, the trail aircraft monitors its position 
relative to the lead aircraft and attempts to maintain a desired separation. As with lateral monitoring, the 
desired alert rate is to be no greater than 10‘ 4 per procedure. Alert integrity due to position uncertainty will 
also be maintained to the same requirement as RNP integrity. 

One difference in the longitudinal monitoring is that the observed longitudinal separation is subject to 
both the ADS-B OUT error of lead aircraft and the longitudinal TSE of both aircraft. Longitudinal TSE 
and its components are assumed to equal the lateral TSE, FTE, and NE in this example, but they can have 
different values in the model. The same assumption is made for the duration of a longitudinal TSE event 
(60 seconds) and the number of longitudinal TSE events in a procedure (6). The uncertainty in ADS-B 
reported position has three components: navigation error (NE), latency compensation error, and 
uncompensated latency error. ADS-B OUT data is assumed to derive from the lead aircraft's navigation 
solution and, therefore, share the same NE. The two latency errors are combined into an ADS-B latency 
error (ALE). The combination of NE and ALE is the estimated position uncertainty (EPU) of the ADS-B 
OUT record. ADS-B EPU is normally reported as a 2-D radius uncertainty and is assumed to conform to a 
Rayleigh distribution. 22 Therefore, the standard deviation of uncertainty in longitudinal position (a EPU ) is 
EPU/2.447. The FA A ADS-B rule requires a maximum EPU of 92.6 m. 24 However, to enable paired 
approaches at runway spacing less than 1000 ft, it is assumed that EPU must be limited to 10 m, a 
Navigation Accuracy Category for Position (NACp) value of 10. 4 

These surveillance errors determine the variation in observed separation to the planned separation. The 
observed separation is the difference in the observed position of the lead aircraft (via ADS-B OUT) and the 
observed position of the trail aircraft (via its navigation system). The ADS-B OUT report represents the 
lead aircraft's observation of its own longitudinal FTE plus the ALE. The trail aircraft uses observation of 
its own position to monitor its longitudinal FTE. Therefore, the variation in observed longitudinal 
separation is a combination of both aircraft's FTE and the ALE of the lead aircraft: 

G obs = J ( g FTe) lead + ^FTe) trail + ^ALE^ead (^) 

The standard deviation of ALE is computed by subtracting the contribution of NE to EPU: 



The longitudinal alert uses similar probability assumptions to the lateral alert. The longitudinal alert 
rate is 10‘ 4 per procedure with alerted hardware failures occurring with a probability of 5 x 10‘ 6 per 
procedure.^ Therefore, alerts due to separation performance (ar sep ) are 9.5 x 10‘ 5 per procedure or 1.583 x 
10‘ 5 per FTE sample. During dependent operation (i.e. before the fast aircraft reaches its final approach 
speed), there are two contributors to deviation in separation performance. The first is the variation in 
observed separation. The second is the response time (t de i ay ) of the fast aircraft to the slow aircraft. During 
Ueiay? the airspeed difference between the two aircraft can vary. Torres-Pomales et al. provide estimates of 
tdei ay ; the examples in this paper will assume t de i ay is 3.5 seconds. 3 For this study, the longitudinal airspeed 
difference is assumed to vary with a standard deviation (a AV ) of 3.4 KT (5.7 ft/s or 1.7 m/s); this number is 
derived from an assumed 3 KT standard deviation in the horizontal airspeed of each aircraft. The 
equivalent spatial variation (a Ax ) is the product of t de i ay and a AV . If we assume t de i ay is 3.5 seconds then, a Ax 
is approximately 20 ft. Therefore the total variation in separation performance (a sep ) is: 


TT For simplicity, the model defines independent contributions from hardware failures to lateral and 
longitudinal alerts when it is likely that both alerts rely on the same hardware. When alerts rely on the 
same hardware, one should apply the contribution from hardware failures to the overall alert rate for the 
procedure and then divide the remaining alert rate due to drift between lateral and longitudinal components. 
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The longitudinal alerting bound (x alert ) is therefore: 

x alert @sep ^ ^ f (l- 2 CW se p^ (13) 


The integrity of the longitudinal alert also uses similar probability assumptions to the lateral alert. Un- 
alerted longitudinal containment loss is 10' 5 per hour with the contributions of un-alerted hardware failure 
(upavionics) and position uncertainty (up TS E) both at 8.3 x 10‘ 8 per FTE sample. Derivation of the integrity 
bound (x integrity ) is similar to the lateral integrity bound with the following differences. The two probability 
density functions (PDF) involved are the PDF of separation performance (a function of a sep ) and the PDF 
of navigation uncertainty. However, the navigation uncertainty in this case is the combined navigation 
uncertainty of the two aircraft. Since the navigation uncertainty of the two aircraft is assumed equal, the 
PDF of the combined navigation uncertainty is a function of V2 g ne . The resulting equation for x integrity is: 
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The design-to, longitudinal window for the trail aircraft (x window ) is double the larger of y a i ert and yintegnty 
Table 4 summarizes the probabilities used to define normal operation in this section. Table 5 shows the 
values of a sep , a NE , x alert , x integrity , and x window , rounded up to the nearest foot for the example aircraft fleet. 


Table 4: Summary of Probabilities Defining Normal Longitudinal Deviation 


Total Alert Rate (ar aircraft ) 

10' 4 / procedure 

Hardware Alert Rate (ar avionics ) 

5 x 10' 6 / procedure 

Position Alert Rate (ar ETE ) 

9.5 x 1 O' 5 / procedure 

1.583 x 10 s /FTE sample 

Total Un-alerted Lateral Containment Loss (up proced ure) 

1.17 x 10' 6 / procedure 

Loss due to un-alerted hardware failure (up avionics ) 

5.0 x 1 O' 7 / procedure 

8.3 x 1 O' 8 / FTE sample 

Un-alerted loss due to position uncertainty (up TSE ) 

5.0 x 1 O' 7 / procedure 

8.3 x 1 O' 8 / FTE sample 

Number of FTE samples per procedure (n ETE ) 

6 

Duration of FTE sample 

60 seconds 


Table 5: Example Longitudinal Deviation Parameters under Normal Operation 


^sep 

97 ft 

^NE 

5.9 ft 

Xalert 

403 ft 

Xintegrity 

418 ft 

Xwindow 

836 ft 


D. Calculating the Wake-Safe Distance 

The required wake-safe distance (L wake -fr ee ) is a simple summation of the longitudinal 
separation window (x window ) and the front-gate (x front . gate ): 


L 


wake- free x front-gate x window 


(15) 
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E. Determining Feasible Runway Separation 

The feasible runway separation can be computed as a function of the required wake -safe distance (L wake . 
f r ee) and the lateral integrity (yintegrity)- First, the required wake transport distance (D enC ounter) is computed by 
inverting Equation 4: 


D , 


encounter 


'-“wake- free ' 


v transport 


v. 


trail 


(16) 


Before the FAF, the worst-case wake transport velocity (V tr ansport) is equal to the maximum allowable 
adverse crosswind of 10 KT. The trail aircraft velocity (V tra ii) is nominally 180 KT but we will assume that 
variation in speed performance can decrease it to a minimum of 177 KT. 

With D encounter computed, the minimum runway separation (AY runway ) that is feasible for the procedure is: 


AK 


runway 


= 224.5 ft + D, 


encounter 


2 yintegrity 


(17) 


Table 6 shows the results, rounded up to the nearest foot, for the example aircraft fleet: 

Table 6: Feasible Separation Geometry 


^front-gate 

3500 ft 

Fwake-free 

4336 ft 

F) encounter 

245 ft 

AY 

^ 1 runway 

1011 ft 


The results show that the example aircraft fleet cannot conduct the paired approach procedure as defined by 
the selected procedure parameters at runways separated by less than 1011 ft. Getting to smaller separations 
can be achieved by relaxing some of the procedure parameters like rate of alerts, minimum approach speed, 
or maximum approach speed difference. Fikewise, obtaining better data on aircraft technical performance 
(TSE and speed schedule deviation) or avionics failures may also reduce the minimum feasible runway 
separations when fed back into this model. However, achieving feasibility on runway separation below 
900 ft will likely require technology advances that reduce aircraft TSE by half (< 20 m). 3 

IV. Conclusions 

An analytical model was derived to ascertain the feasible runway separation for a paired approach given 
procedure parameters that define bounds on normal operation, aircraft performance errors, avionics failure 
rates, and surveillance errors. To bound normal operation, the model uses a target limit on abort alerts, a 
target containment probability for position integrity, a maximum allowable crosswind, and a maximum 
wingspan. Furthermore, the model presented here relies on the algebraic model of Ref. 3 and Ref. 7 to 
estimate the front gate position. That front-gate model uses additional parameters that bound normal 
operation, specifically the minimum airspeed of the slow aircraft and maximum approach speed difference 
of the fast aircraft. Aircraft performance is characterized using normal distributions for flight technical 
error and navigation error and setting bounds on deviation from speed schedule. Avionics failure rates 
include fixed probabilities for both alerted and unalerted failures. Surveillance errors are normal 
distributions of ADS-B estimated position uncertainty that can be taken from the NAC p table. Altogether, 
these parameters cover much of the design and performance space for simultaneous paired approaches. 
Through its use of probability density functions (PDFs), the analytical model also ensures that results do 
not represent artificial truncations in the rare probability of extreme performance errors or uncertainties. At 
the same time, the model is simple enough to script in a mathematical package like Matlab or to implement 
in a computing language like C. The example results presented here were produced in Matlab, and 
execution time took seconds. Thus, the model allows investigators to more rapidly narrow the solution 
space and use more compute intensive Monte-Carlo simulation for validation and refinement. The 
analytical model cannot replace Monte-Carlo simulations because the analytical model relies on simple 
kinematic relationships and idealized PDFs. Monte-Carlo simulations are able to provide increasing levels 
of fidelity to more accurately simulate the performance of real aircraft but at the cost of massive runs to 
assure that very rare events are represented in the results. 
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